6 ms·

I'm a little paranoid about my code. I want to like github's private repos, but I don't want my code to be stolen by github's internal employees. I've heard th

by MollyR 12y ago

I'm a little paranoid about my code. I want to like github's private repos, but I don't want my code to be stolen by github's internal employees. I've heard that their employees do shady things on occasion (2nd hand knowledge).

scott_karana 12y ago
Employees of any company in the world can do shady things. You need to trust your server hosting company, your server OS vendor, your own workstation's software, your OS, all your firmware... If GitHub employees stole proprietary code from you, and commercialized it, proving "prior art" and theft should be extremely easy for you. IANAL, but it's not something I'd worry about with most companies hosting on Github.
- ProAm 12y ago
  > proving "prior art" and theft should be extremely easy for you If you even find out, and if you do it would cost a lot of time and money to reclaim what is yours. It's not hard to setup your own servers, it's becoming a lost art in today's cloud microcosm but its really not hard to do yourself and do it right.
  - scott_karana 12y ago
    I agree that self-hosting can be cheaper than lawyers. I self-host all my own stuff, but I still understand how it's better for some businesses to pay for cloud services, instead.
- RaleyField 12y ago
  > your server OS vendor, your own workstation's software, your OS, all your firmware They all stake their reputation so in theory they have checks in place to minimize rogue behavior (in practice though they are often clueless, see starfish). Also they put their code/hardware into public so they normally can't target individuals without fearing others to discover their attempts. Contrast this to rogue employees at Github who can copy repositories for their old colleagues from college to give them an edge and the only difference you will ever see manifested is competitors seemingly always having timely answers to any new features you are about to unveil in your solution, because they were too smart to copy/paste your code directly.
this_user 12y ago
If you want a similar solution to GH instead of just a bare Git installation, you could look into running your own GitLab instance. Their software is open source and freely available. Of course, that way you would have to trust your hoster unless you are running your own in-house server.
- sytse 12y ago
  Thanks for mentioning GitLab this_user. I would be happy to answer any questions about GitLab.
  - SSLy 12y ago
    Just a quick question: why are the git-annex and branch protection available only in EE SKU?
    - sytse 12y ago
      Branch protection is also available in the open source GitLab CE. We made git-annex an enterprise feature because it is one of the few things that came up more from larger organizations, smaller ones tend to use a shared Dropbox.
      - SSLy 12y ago
        Oops, sorry for confusion, I've meant to ask about the Rebase merge requests before merge feature, not branch protection.
        sytse 12y ago
        We're pretty comfortable with rebase before merge being part of EE only. Someone suggested making an option to select the type of merge you want (ff, no-ff, log, rebase or squash). If someone would submit a good implementation of that and reference this comment we can open source everything. Edit: removed the work probably to make this a firm promise.
      - 12y ago
caipre 12y ago
I wonder whether something like [0] would work, where the repository is encrypted on push and decrypted on pull. Might be against Github's terms of use, though. [0]: https://rovaughn.github.io/2015-2-9.html https://rovaughn.github.io/2015-2-9.html
- MollyR 12y ago
  that's a really cool idea.
- duaneb 12y ago
  Why would that be against github TOS? Encrypted files in git are not exactly unusual.
  - caipre 12y ago
    My thinking was that it's effectively a private repository (albeit publicly visible), so it would subvert their business model.
    - soperj 12y ago
      they were talking about it being a private repo anyway that they were worried about.
      - duaneb 12y ago
        Well, it'd be pretty shitty. Diffs would be binary and practically useless; merges would have to be entirely manual. Github would lose more in brand trust than they would gain in saved costs on those repos (or lost revenue).
- emmelaich 12y ago
  Or perhaps https://github.com/AGWA/git-crypt
ryanackley 12y ago
Statistically speaking, without knowing anything about you, your code is probably not "omg this code is so awesome I will risk losing my job/business because I must possess this code" kind of awesome. If it is, what are the chances of somebody figuring it out when there are literally several million git repos on github. Just be careful. Don't name your repo something like "Cure for Cancer" or "Warp Drive Firmware", etc. and you will probably be in good shape.
Oompa 12y ago
> I've heard that their employees do shady things on occasion (2nd hand knowledge). Care to elaborate?
romanovcode 12y ago
But this is why they offer Github Enterprise. AFAIK it's hosted on your own servers.

by MollyR 12y ago

scott_karana 12y ago

Employees of any company in the world can do shady things. You need to trust your server hosting company, your server OS vendor, your own workstation's software, your OS, all your firmware... If GitHub employees stole proprietary code from you, and commercialized it, proving "prior art" and theft should be extremely easy for you. IANAL, but it's not something I'd worry about with most companies hosting on Github.

ProAm 12y ago
> proving "prior art" and theft should be extremely easy for you If you even find out, and if you do it would cost a lot of time and money to reclaim what is yours. It's not hard to setup your own servers, it's becoming a lost art in today's cloud microcosm but its really not hard to do yourself and do it right.
- scott_karana 12y ago
  I agree that self-hosting can be cheaper than lawyers. I self-host all my own stuff, but I still understand how it's better for some businesses to pay for cloud services, instead.
RaleyField 12y ago
> your server OS vendor, your own workstation's software, your OS, all your firmware They all stake their reputation so in theory they have checks in place to minimize rogue behavior (in practice though they are often clueless, see starfish). Also they put their code/hardware into public so they normally can't target individuals without fearing others to discover their attempts. Contrast this to rogue employees at Github who can copy repositories for their old colleagues from college to give them an edge and the only difference you will ever see manifested is competitors seemingly always having timely answers to any new features you are about to unveil in your solution, because they were too smart to copy/paste your code directly.

this_user 12y ago

If you want a similar solution to GH instead of just a bare Git installation, you could look into running your own GitLab instance. Their software is open source and freely available. Of course, that way you would have to trust your hoster unless you are running your own in-house server.

sytse 12y ago
Thanks for mentioning GitLab this_user. I would be happy to answer any questions about GitLab.
- SSLy 12y ago
  Just a quick question: why are the git-annex and branch protection available only in EE SKU?
  - sytse 12y ago
    Branch protection is also available in the open source GitLab CE. We made git-annex an enterprise feature because it is one of the few things that came up more from larger organizations, smaller ones tend to use a shared Dropbox.
    - SSLy 12y ago
      Oops, sorry for confusion, I've meant to ask about the Rebase merge requests before merge feature, not branch protection.
      - sytse 12y ago
        We're pretty comfortable with rebase before merge being part of EE only. Someone suggested making an option to select the type of merge you want (ff, no-ff, log, rebase or squash). If someone would submit a good implementation of that and reference this comment we can open source everything. Edit: removed the work probably to make this a firm promise.
    - 12y ago

caipre 12y ago

I wonder whether something like [0] would work, where the repository is encrypted on push and decrypted on pull. Might be against Github's terms of use, though. [0]: https://rovaughn.github.io/2015-2-9.html https://rovaughn.github.io/2015-2-9.html

MollyR 12y ago
that's a really cool idea.
duaneb 12y ago
Why would that be against github TOS? Encrypted files in git are not exactly unusual.
- caipre 12y ago
  My thinking was that it's effectively a private repository (albeit publicly visible), so it would subvert their business model.
  - soperj 12y ago
    they were talking about it being a private repo anyway that they were worried about.
    - duaneb 12y ago
      Well, it'd be pretty shitty. Diffs would be binary and practically useless; merges would have to be entirely manual. Github would lose more in brand trust than they would gain in saved costs on those repos (or lost revenue).
emmelaich 12y ago
Or perhaps https://github.com/AGWA/git-crypt

ryanackley 12y ago

Statistically speaking, without knowing anything about you, your code is probably not "omg this code is so awesome I will risk losing my job/business because I must possess this code" kind of awesome. If it is, what are the chances of somebody figuring it out when there are literally several million git repos on github. Just be careful. Don't name your repo something like "Cure for Cancer" or "Warp Drive Firmware", etc. and you will probably be in good shape.

Oompa 12y ago

> I've heard that their employees do shady things on occasion (2nd hand knowledge). Care to elaborate?

romanovcode 12y ago

But this is why they offer Github Enterprise. AFAIK it's hosted on your own servers.